Limited use medical probe

ABSTRACT

A limited use medical probe is disclosed, including a memory for maintaining a use value. The medical probe is coupled to a medical device that inhibits its function when the use value reaches a predetermined threshold value, preventing improper use of the probe. The probe memory may also store identification, usage, and clinical data. A probe auto-identification function, a probe re-identification function and a probe functional test sequence are disclosed for the medical probe. After use, a reprocessing step may reset the probe memory, permitting further probe use.

This application is a divisional of U.S. application Ser. No.10/361,167, filed Feb. 6, 2003, which is a continuation-in-part ofapplication Ser. No. 10/045,475, filed Oct. 22, 2001, now abandoned,which is a continuation of application Ser. No. 09/291,769, filed Apr.14, 1999, which is now issued as U.S. Pat. No. 6,308,089 on Oct. 23,2001, the disclosures of which are incorporated herein by reference.

BACKGROUND OF THE INVENTION Field of the Invention

The present invention relates generally to medical probes, includingsensor devices and methods for measuring clinical physiologicalparameters including vital signs. More particularly, the invention isconcerned with a medical system that limits the use of an associatedmedical probe according to usage criteria to prevent misapplication,overuse and potential failure, including auto-identification of theprobe, addressing the problem of re-identification when the connectionof a medical probe to the medical device is interrupted during use. Theinvention describes a medical reprocessing system that performsreprocessing (utilization history review, functional testing, andauthorization for reuse) of a previously used medical probe. Usagecriteria may include duration and/or number of uses, shelf or warrantylife, and/or compatibility of the medical probe with the patient and/orselected medical probe function(s).

Medical probes include devices that are inserted into a body cavity orunder the skin of a patient in order to perform therapy or monitoring.Such probes, including devices to view or scan tissue, or monitorbiological parameters, are well known in the art. A sensor devicetypically comprises a housing including at least one sensor such as apressure sensor; a light emitting device and associated detectorcomprising a pulse oximetry sensor; an ECG sensor; or other vital signmonitoring device; plus a means of conveying information from the sensordevice to a caregiver. One particular example of a medical sensor deviceis fetal sensor, including external sensors placed on the maternalabdomen and internal sensors placed through the birth canal onto a partof the fetus. An example of an internal fetal sensor is a fetal pulseoximetry sensor, such as described in U.S. Pat. No. 5,425,362 to Sikeret al. The sensor described therein is inserted past the cervical osinto the uterus of the mother to non-invasively monitor the condition ofa fetus, a mother, and/or a placenta.

One problem associated with known medical probes is that they have alimited life span. Probes are prone to wear through repeated use orthrough extended use over a period of time, and through cleaning andsterilization processes. Problems associated with such overuse includespurious readings as internal wires and connectors become loose. Moreimportantly, probes that are used repeatedly or over an extended periodof time are prone to break. Once such an incident occurs, it is oftendifficult to determine when the probe failed, or to track the cause ofsuch an occurrence. Furthermore, medical probes often have a limitedshelf life or warranty period, i.e., the period of time aftermanufacture during which they are guaranteed to function properly. Anout-of-date medical probe may fail to function to manufacturer'sspecifications, posing a health risk to the patient.

To prevent these problems, medical clinicians may limit the number andduration of uses of a given probe through an equipment log or othermanual system. While such systems may be effective in certaincircumstances, they rely heavily on manual records, which aretime-consuming and difficult to maintain, particularly since thecooperation of a number of clinical personnel is required. In busyhospital settings, and especially in emergency situations, such systemsare difficult to manage and are easily overlooked or ignored.

The prevalence of medical errors, some related to misuse of medicaldevices, has been detailed in the 1999 Institute of Medicine report “ToErr is Human,” chapter 2, ISBN 0-309-06837-1. Interest in reducingmedical errors has motivated an initiative to uniquely identify alldrugs and medical devices, to assist in prevention of medical errors bycorrelating the drug or device with the patient's identification andintended procedure. In response to a U.S. Food & Drug Administration(FDA) suggestion to use bar codes under the Universal Product Numbering(UPN) system, the Advanced Medical Technology Association (AdvaMed), amedical device industry association, has suggested in a statement toemploy generic “auto-identification” methods, which could include RF orother electronic means as an alternative to bar code technology.(Statement to the Food & Drug Administration by T. Cammack on Jul. 26,2002.)

A particular class of medical probe is the single-use device (SUD). Adevice may be designed as an SUD by the manufacturer for severalreasons, including: the risk of cross-contamination between patients;because some key component (for example, a battery or reagent) issufficient only for one use; due to difficulty in the cleaning andsterilization to permit reuse; or due to the prohibitive cost ofproducing a device durable enough to be reused. Despite manufacturersdesignations, clinical institutions and third-party services sometimeschoose to refurbish SUDs and reuse them. This practice has becomeincreasingly common as clinical institutions experience financialpressures, since a SUD may be refurbished at a substantial discount fromthe retail price of a new one.

Typically, refurbishing of an SUD entails cleaning, inspection,sterilization, replacement of worn or exhausted components, andre-validation for safety and efficacy. The practice is so widespreadthat regulatory bodies in the United States and around the world haveinstituted legislation to limit and/or monitor the reuse of SUDs. TheFDA documents “Premarket Guidance: Reprocessing and Reuse of Single-UseDevices” (Jun. 1, 2001) and “Labeling Recommendations for Single-UseDevices Reprocessed by Third Parties and Hospitals” (Jul. 30, 2001) haveprovided guidance with respect to compliance with the U.S. regulatoryrequirements. One aspect of regulation that is being emphasized is theneed for good record keeping in tracking the history of use of an SUD,including how long and in what fashion the SUD was used.

The manufacturer of a medical device also faces the possibility ofcounterfeiting. In some cases, an unscrupulous manufacturer seeks toavoid paying licensing fees for proprietary technology used in thedevice. Even if misappropriation of intellectual property is notinvolved, a second manufacturer may seek to undercut the price of theoriginal device by producing it with less expensive components, labor,or both. In any case, when a lower-quality device is used in a medicalapplication, patient safety becomes the issue. In particular, SUDs orlimited-use devices are generally designed to work in conjunction with amedical monitor. It is important to ensure that every medical sensingdevice utilized with the monitor is designed and calibrated to workproperly with it.

Several partial solutions to the problem of controlling use of a medicalprobe have been proposed. U.S. Pat. No. 5,991,355 to Dahlke proposed asimple identification and counting system associated with anelectrophysiology sensor for the purpose of limiting reuse of saidsensor. However, the method entails simple counting of uses, withoutsupport for usage limitation based upon utilization time; nor does itinclude device identification.

In U.S. Pat. No. 5,400,267 to Denen et al., a medical device(electro-surgical knife) with an embedded non-volatile memory componentis described. The memory stores utilization limits and operatingparameters. The invention permits the system attached to the device (inthat case, a power supply) to (a) configure itself for appropriateoperation with the device, and (b) disable the device after someoperational limit is exceeded. The need for re-identification of themedical device if the connection with the system is broken is disclosed.This is intended to prevent the system from counting any pause in useless than a preset period as a new use. However, the patent proposesonly to store the current time in the medical device during use, withoutconsidering how to prevent this data from being manipulated to preventthe system from detecting the occurrence of a new use.

U.S. Pat. No. 6,237,604 to Burnside et al. proposes usage control basedupon cycles or usage time, but fails to address the management oflegitimate medical probe reprocessing.

U.S. Patent Application 2002/0095078 A1 to Mannheimer et al.specifically relates to pulse oximetry sensor reuse, supporting limitson number of sterilization cycles or warranty expiration date. None ofthese patents or applications addresses the need for security featuresor security functions to prevent product counterfeiting or tamperingwith the usage control method.

Similarly, the non-medical sensing device for attachment to ameasurement instrument described in U.S. Pat. No. 5,162,725 to Hodson etal. offers no provision for establishing the authenticity of the sensingdevice (e.g., probe) when it is coupled to the instrument. That is, nomeans is suggested to solve the problem of preventing use of acounterfeit sensing device, that is constructed to include similarcalibration and identification data.

The prevalence of electronic technology in the world makes it relativelyeasy to counterfeit the memory devices proposed for control of reusewith modest effort. Potentially, a medical device could be reprocessedby replacing the memory component with a copy made from an unusedoriginal. The counterfeit memory could be placed in a reusable adapterused in conjunction with an expired medical probe. Alternatively, anentire counterfeit sensing device could be manufactured that wasindistinguishable with respect to the memory component or its content.

The U.S. Health Insurance Portability and Accountability Act of 1996expressed the need for protection of privacy in storage and transfer ofhealthcare information. This is detailed in the Federal Register, Vol.63 No. 155, 45 CFR Part 142, Security and Electronic SignatureStandards.

Another application of a memory component associated with a medicalprobe is storage of patient data and patient identification data,disclosed in related inventions U.S. Pat. No. 6,308,089 to von der Ruhret al. and continuation application Ser. No. 09/291,769. Theaforementioned patent reveals the use of encryption to permit the securestorage of data related to the usage of a medical probe, including oneor more of its identifying data, duration of use, number of uses, ortime and date stamp of use.

U.S. Patent Application 2002/0095077 A1 to Swedlow et al. disclosesstorage of patient identification data, pulse rate, and oxygensaturation values, etc., in a pulse oximetry sensor. However, a meansfor secure storage and data transfer to ensure data integrity andprivacy is not disclosed.

Secure data storage and transfer in automated systems can be achievedutilizing a physical security method and/or an algorithmic securitymethod. The physical security method relies upon the use of a physicalobject which might be difficult to bypass or forge, such as a doorrequiring a physical key to unlock it, whereas an algorithmic securitymethod might rely upon the use of secret data, such as a password orpersonal identification number (PIN) entered into a keypad. Inbiometrics, the physical “key” is some characteristic physical propertyof the authorized user, such as a fingerprint, retinal image,voiceprint, and so forth. Combining multiple techniques of usingphysical and/or algorithmic security methods offers the best hope ofproviding a secure authentication method. This strategy can be appliedto the problem of securing the data in a limited use medical sensor.

The more usage, calibration, and clinical data that is to be stored in amedical probe, the more important it becomes to utilize an efficientstorage method. Data compression, particularly lossless datacompression, is an encoding method to store more data in less physicalmemory without information loss. Error detection and correction can alsobe part of the method. The encoding of data in a medical probe shouldpreferably address the needs of data security, integrity, and storageefficiency.

There remains, therefore, a need for a medical system that canautomatically control the use of a medical probe through enforcement ofusage criteria. Such usage criteria would include: limiting the durationand/or number of uses of the probe to a predetermined limit value;limiting use of the probe to a shelf life or warranty period; permittinguse of the medical probe only after validation of the combination ofmedical probe, patient and procedure; and limiting access to patientdata stored within the medical probe to ensure patient privacy.Preferably, the medical system would also provide additional functions,such as data compression, error checking, time and date stamping, andsecurity checking, that would facilitate this usage control, as well asregulated reprocessing of medical probes prior to reuse. Data stored inthe medical probe, related not only to probe usage but also patientidentity and condition, should be held in a secure fashion.

It is therefore an object of the invention to provide a medical systemthat can limit the number of times a medical probe is used.

It is another object of the invention to provide a medical system thatcan limit the duration of the use of a medical probe.

It is yet another object of the invention to provide a medical systemthat can limit the use of a medical probe to a certain shelf life orwarranty period.

It is still another object of the invention to provide a medical systemthat provides a time and date stamp to identify when the therapeutic ormonitoring operation performed by the medical system in conjunction withthe medical probe took place.

It is a still further object of the invention to provide a medicalsystem that provides an auto-identification function to validate properuse of a medical probe with a medical device on a particular patient fora requested therapy or monitoring function.

It is another object of the invention to provide a medical probe thatcan store data regarding the duration of use of the probe.

It is yet another object of the invention to provide a medical probethat can store data regarding the number of times the probe has beenused.

It is still another object of the invention to provide a medical probethat can store a usage limit on the number of times or duration of timethe probe may be used.

It is yet another object of the invention to provide a medical probethan can store data regarding the reprocessing of the medical probe forsubsequent reuse.

It is a yet further object of the invention to provide a medical systemin which identifying data for the medical probe and other medicaldevices is stored in each.

It is another object of the invention to provide a medical system inwhich a medical device can re-identify a medical probe after aninterruption in use, to prevent the interruption from being construed asa new use.

It is still another object of the invention to provide a medical systemthat includes a security function for verifying the identity of anattached probe.

It is yet another object of the invention to provide a medical systemthat includes a security function to prevent tampering with data storedin the probe.

It is a still further object of the invention to provide a medicalsystem that employs a data encoding system including encryption as analgorithmic security method when storing data in the medical probe aspart of a security function.

It is another object of the invention to provide a medical system thatincludes a probe functional test sequence.

It is another object of the invention to provide a medical reprocessingsystem that can read the usage data in an attached medical probe.

It is a yet further object of the invention to provide a medicalreprocessing system that can store reprocessing data in an attachedmedical probe.

It is still another object of the invention to provide a medicalreprocessing system than can store usage control data in an attachedmedical probe, indicating the number of reuses and/or duration of reuseof the probe to be permitted subsequent to reprocessing.

It is a still further object of the invention to provide a medicalreprocessing system that can detect and delete patient data from anattached medical probe.

It is yet another object of the invention to provide a medicalreprocessing system that includes a security function for verifying thatreprocessing of an attached medical probe is permitted.

It is another object of the invention to provide a medical reprocessingsystem that includes an authorization function to prevent reprocessingof an attached medical probe without obtaining authorization in a securefashion from a licensing or regulatory party.

SUMMARY OF THE INVENTION

In one aspect, the present invention is a medical probe that includes atleast one effector or sensor device and a probe memory for maintaininguse data, e.g., use values, about usage of the probe. The probe memorycan include use values such as data regarding the number of times themedical probe has been used, the duration of each use, the totalduration of use in conjunction with one or more medical devices, andother data regarding the duty cycle of usage of the medical probe. Otheruse values, include the date and time of a given use of the probe, thedate and time when a given condition occurred, product identity,clinical data such as patient or doctor data, and other medical data canalso be stored in the memory storage location of the sensor device.Certain contents of the probe memory are processed by an encoding systemincluding encryption and stored in encrypted form to facilitate securityfunctions as well as maintain confidentiality of patient data. Themedical probe preferably contains identifying data (such as a lot numberor unique serial number) which is electronically readable, that can beused in a security function to identify the device and prevent tamperingwith the use data. The serial number can serve an auto-identificationfunction for reducing medical errors.

The medical probe, capable of communicating with external devices, iscoupled to a medical device to provide a medical system. The medicaldevice, through communications with the medical probe, applies usagecriteria to limit use of the medical probe. Usage criteria include datalimiting the use of the medical probe. The medical device determinesusage of the medical probe and limits the total use of each medicalprobe to a limit value by preventing use beyond a predetermined usagelimit. The usage limit, as noted above, can be based on one or more ofthe following usage criteria: total number of uses, total duration ofuse, shelf life, warranty period, regulatory guidelines or licensingagreement. Usage criteria applied by the medical device may furtherinclude validating that the combination of the medical device, patient,and intended therapy or monitoring are correct.

The use of a medical probe may be interrupted without constituting a newuse, i.e., use resumes on the same patient without intervening use onanother patient after a period of interruption sufficiently short to notrequire changing the use value. A probe re-identification method isincluded in the invention to prevent unnecessary reduction of themedical probe's intended utility during the course of its useful life.

The medical device, in conjunction with the medical probe, provides aprobe evaluation including a security function for verifying theidentity of the medical probe. Preferably, the security functionoperates on internal serial numbers and encryption keys to ensure thatthe proper probes are coupled to the medical device, that the internaluse data has not been tampered with, and to verify communicationsbetween the medical probe and medical device. An auto-identificationfunction is advantageously included in the probe evaluation.

The medical device may include a functional test sequence applied to themedical probe prior to use. Preferably, the medical device can determinethat the medical probe is working within normal operating parameters byperforming the functional tests. For effectors, the testing may includea determination that power outputs are within expected values. Forsensors, the testing may evaluate sensitivity and signal to noise ratio.Expected test results based upon design testing, factory calibration, orprevious functional tests may be stored in the medical device and/or themedical probe for comparison purposes.

The medical system can also provide a series of product identityfunctions, as well as storing the identifying data (e.g., serialnumbers) for the equipment used in a given medical procedure. The storeddata can further include a date and time stamp, identifying dataregarding the medical personnel involved in a monitoring procedure,identifying data about the patient, clinical data, and other datarelated to clinical use. The stored data can further include datarelated to reprocessing of the medical probe, such as personnel andfacility identification, data and time of reprocessing, andauthorization by a licensing or regulatory party. Once again, in apreferred embodiment an encoding system including encryption is utilizedfor data compression, error checking, and to ensure authenticity and toprotect patient confidentiality.

Subsequent to use of the medical probe past usage limits, the medicalprobe may optionally be attached to a medical reprocessing system. Themedical reprocessing system communicates with the probe memory of themedical probe, utilizing the data therein to direct reprocessing andmaintain a database regarding the history of the probe. An optionalauthorization step by a licensing or regulatory party may furtherqualify the decision-making. If reprocessing is successful, the contentsof the probe memory of the medical probe is amended or modified topermit further use; if reprocessing is unsuccessful, the medical probeis rendered inoperable.

The medical probe preferably includes a probe memory such as a low-powerintegrated circuit. In one preferred embodiment, the probe memory is anadd-only memory (AOM) that is embedded in the medical probe. The AOMpreferably includes a tamper-proof serial number and medical equipmentmanufacturer identification field written by the AOM manufacturer as abuilt-in security function to prevent counterfeiting of the AOM; a fieldof identifying data and usage criteria data written by the medical probemanufacturer at the time of probe production; a field of use valueswritten by the medical system in the course of clinical use; and a fieldof reprocessing data written by the medical reprocessing system.

In one highly preferred embodiment of the invention, the medicalmonitoring system comprises a fetal sensor for monitoring oxygensaturation in the blood of a fetus while in the womb. The probe memoryis embedded in the connector used to attach the medical probe to themedical device, which is a fetal pulse oximeter.

Other advantages and features of the invention, together with theorganization and manner of operation thereof, will become apparent fromthe following detailed description when taken in conjunction with theaccompanying drawings wherein like elements have like numeralsthroughout the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a medical monitoring system constructed inaccordance with the present invention;

FIG. 2 is a block diagram of a medical monitoring system constructed inaccordance with a preferred embodiment of the present invention;

FIG. 3 is an operational block diagram of the medical monitoring systemof FIGS. 1 and 2 of the present invention;

FIG. 4 is a fetal sensor for use with a medical device of the medicalmonitoring system of FIGS. 2 and 3 of the present invention;

FIG. 5 is a block diagram of a medical reprocessing system constructedin accordance with the present invention;

FIG. 6 is a block diagram of a medical reprocessing system constructedin accordance with a preferred embodiment of the present invention; and

FIG. 7 is an operational block diagram of the medical reprocessingsystem of FIGS. 5 and 6 constructed in accordance with the presentinvention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

Referring now to FIGS. 1-7, and more particularly to FIG. 1, a blockdiagram of a medical system constructed in accordance with the presentinvention is shown at 10. Generally, the medical system 10 comprises amedical device 12 and a medical probe 14.

Preferably, the medical device 12 includes a data acquisition device 13,a controller 16, an audio output device 17, at least one memory 18, anda display 20. Preferably, the controller 16 includes a device (host)communications port 19 such as a serial communications port or otherdigital communication means. The controller 16 is preferably amicroprocessor, but can comprise a micro-controller or various othertypes of control devices. The memory 18 preferably comprises a RAM(read/writable) device and an EPROM (read only) device, but other knowntypes of memory devices may be used without departing from theinvention. Preferably, the medical device will include non-erasablememory components for storing a serial number, as will be described morefully below. In some applications, the controller 16 may include amemory 18 as part of the integrated circuit, thereby eliminating theneed for external memory devices.

Hereafter where reference is made to writing a message to the display 20of the medical device 12, it will be understood that this can refer to atext message on an alphanumeric or graphic display. Alternatively, thedisplay 20 may comprise a bank of indicator lights or LEDs that providesimilar data.

The medical probe 14 generally comprises an effector/sensor 24, a probememory 26, and an external connection 120 configured for communicatingand transferring data between the medical device and the probe. Aneffector may comprise any of a number of therapeutic devices forcutting, delivering electrical, acoustic, or RF energy, etc. A sensormay include pressure sensors, ECG sensors, EEG sensors, temperaturesensors, oxygen sensors, ultrasound transducers, chemical sensors, etc.The selection of effectors/sensor(s) 24 and associated hardware used inthe medical system 12 is dependent only on the type of therapeutic ormonitoring functions to be performed without reference to other aspectsof the invention. The connection 120 between medical probe 14 andmedical device 12 is preferably electrical in nature, but mayalternately be fiber optic, free-space optical (e.g., infrared), orradio frequency.

In FIG. 2, a preferred embodiment of the medical system 10 is a pulseoximeter 101 having a medical probe 14 and a medical device 12. Themedical probe 14 and medical device 12 are as previously describedherein except that the effector/sensor 24 includes light emittingdevice(s) 30 and associated detector(s) 32. In a preferred embodiment,the light emitting devices 30 are light-emitting diodes (LEDs).

Data used in the medical system 10, 101 is preferably in a digitalelectronic format.

Referring now to FIGS. 1 and 2, the probe memory 26 can comprise anumber of various known devices including microcontrollers ormicroprocessors, EPROMS, EEPROMS, or application specific chips. Thesedevices provide a memory location for maintaining data concerning use ofthe medical probe 14. The probe memory 26 also includes probecommunications port 27 such as a serial communications port or otherdigital communication means. In some applications, separatecommunication devices may also be included. Preferably, moresophisticated devices that provide functions such as product identity,security checking, and date and time stamping are used.

The security function includes a physical security method and/or analgorithmic security method. The physical security method and/oralgorithmic security method may be used in the storage and transfer ofdata from the probe memory 26 to the medical device 12. In a preferredembodiment of a physical security method, the probe memory 26 is amemory that can be written only once, such as a PROM or EPROM, providingphysical security of the data (i.e., 0's can be rewritten as 1's, butnot vice versa). In one highly preferred embodiment of the invention,the probe memory comprises an add-only memory (AOM) which haspre-programmed serial number and medical equipment manufacturer data. Anadd-only memory provides physical security of the already-written data(i.e., prevents remaining 0's in the written data from later beingrewritten as 1's).

Algorithmic security methods involve the use of an encoding systemincluding algorithms to verify the integrity of data, e.g., the cyclicredundancy check (CRC); and algorithms to prevent unauthorized access tothe data, e.g., encryption. The algorithms may be implemented assoftware in a processor, or as a hardware circuit, without changing theintent. Preferably, the encoding system will also accomplish losslesscompression of the data to reduce the physical storage requirements ofthe memory.

Other highly preferred devices that can be used for the probe memory 26include a token card chip that includes both memory storage and securityfunctions, and EEPROMS with built-in CRC and serial number functions.These preferred devices will be described more fully below. (The use ofa token card chip for limiting the use of a medical probe is disclosedin Applicants' U.S. Pat. No. 6,308,089 and pending patent applicationSer. No. 10/045,475, the disclosures of which are herein incorporated byreference.)

As noted above, an important function of the probe memory 26 is to storedata regarding the duration of use of the medical probe 14, and/or tomaintain a history of the number of uses of the medical probe 14. Thisdata will hereinafter be referred to as “use value”. The probe memory 26can also store data such as, but not limited to, date of manufacture,warranty information, security data such as serial numbers or lotnumbers, product identity and encryption keys, history data such as theidentity of medical workers (caregivers) involved in the monitoringprocess (procedure), patient data including physiological data collectedby the sensor (or effector) 24 itself or transferred from another sourcevia the medical device 12, and other types of data. The serial numbercan serve an auto-identification function when combined with patient,procedural, and caregiver identifying data by the medical device 12 todetermine if a valid combination has been made, as described below. Inalternative embodiments, the probe memory 26 may also be used to storeas data the results of functional test routines and other producttesting data.

The memory 18 of the medical device 12 preferably also includes datasuch as identifying data (e.g., serial numbers) identifying themonitoring device and encryption keys, that can be used to verifycommunications and identify devices as will be described below. Toprovide physical security, this data is preferably stored innon-erasable memory components (not shown) such as a read-only memory(ROM). The memory 18 preferably also stores other data, such astroubleshooting and calibration data to provide a cross check againstthe data stored in the medical probe 14.

Identifying data for the medical probe 14, usage criteria, and one ormore encryption keys can also be stored in the probe memory 26 at thetime of manufacture of the medical probe 14. The identifying data ispreferably a serial number used to uniquely identify a specific probe,as well as to identify the type of probe. In some embodiments,identifying data may consist of a production lot number instead of aunique serial number. Preferably, data relating to the date ofmanufacture, revision codes, and calibration data, determined by thetype of probe or its specific assembly, can also be stored in the probememory 26 at the time of its manufacture.

At the time of manufacture of the medical probe 14, data representingone or more usage limit(s) representing either a count (number of timesof medical probe 14 use) or time duration (length of time medical probe14 is used) can be written into the probe memory 26. Alternatively, theusage limit(s) may be embedded in the memory 18 of the medical device12. In addition to or in place of these usage limit(s), data such as thedate of manufacture or reprocessing stored in the medical probe 14 mayserve as the basis for limiting probe use based upon shelf life orwarranty period (stored in either the probe or the device). In thiscase, a real-time clock must be maintained in either the medical probe14 itself, or the medical device 12.

FIG. 3 (3A, 3B, 3C) is an operational block diagram illustrating amethod of limiting use of medical probe 14 in the medical systems 10,101 shown in FIGS. 1 and 2, respectively. FIGS. 3A, 3B show Steps 38-62.FIG. 3C illustrates the detail of Step 46. The method preferablyincludes use of a security function, a probeauto-identification/re-identification function, and a probefunctionality test sequence. It will be understood in the followingdescription that the “reading” and “writing” of the memory storagedevice 26 in the medical sensor 14 encompasses, in a preferredembodiment, applying an encoding system with encryption to secure thedata when reading from and writing to the memory.

Processing commences when a medical probe 14 is detected as attached tothe medical device 12 in Step 38. To ensure a proper connection andverify that a proper medical probe 14 is coupled to the medical device12, in Step 40 an initial query is transmitted to the medical probe 14.After transmitting such a query to the medical probe 14, the medicaldevice 12 waits for an acknowledgement (signal or message) from themedical probe 14 prior to performing any further steps. This query andacknowledge sequence (Step 40) verifies that the probe memory 26 isreceiving power and can communicate with the controller 16 in themonitoring device 12 through a serial or other communications link.

If, in Step 40, no acknowledgment is received, the controller 16 of themedical device 12 will determine that the medical probe 14 currentlyattached is an incorrect medical probe or is not functional. Preferably,in Step 41 the controller 16 will provide a message to the display 20,such as “Replace Probe”, and/or will emit an audible alarm (medicalalarm) to the audio output 17, and in Step 42, the controller 16 willinhibit functions related to the medical probe 14 until a suitable oneis attached to the medical device 12. Although a query and acknowledgestep, Step 40, is shown, it will be apparent to one of ordinary skillthat the step may not be required in all applications. Furthermore, theability to perform this step will depend on the functionality of thecomponent chosen as the probe memory 26 in the medical probe 14.

Besides evaluating the correctness of a medical probe to the medicaldevice and the immediate functionality via Step 40, the method of thepresent invention in Step 43 further ensures that a proper medical probe14 is coupled to the medical device 12, to secure communications betweenthe medical probe 14 and the medical device 12, and to prevent tamperingwith the use value and/or usage limit(s) stored in the probe memory 26.In Step 43 the medical system 10 of the present invention preferablyuses the serial numbers and encryption keys described above to provide asecurity function. Each serial number is preferably transmitted from oneto the other i.e., from the medical probe 14 to the medical device 12,and from the medical device 12 to the medical probe 14, in encryptedform. The data in the keys and algorithms required by the encryptionaspect of the data encoding system to decrypt the transmitted data arepreferably stored in a secure fashion within each device (medical probe14 and/or medical device 12), or transmitted in a secure fashion.Suitable encryption algorithms for encoding systems are well known,including symmetrical key encryption systems, and asymmetrical keyencryption systems, such as, but not limited to, public key encryption.A cyclic redundancy code (CRC) calculation and check is also commonlyused to validate integrity of transmitted data. A data encoding systemserves not only to verify transmissions and validate data, but can alsodetermine a signature of the transmitted data, thereby identifying thespecific sending device (medical probe 14 and/or medical device 12). Itwill be apparent that some data encoding systems designed for datacompression will also adequately ensure data encryption for a securitypurpose.

Preferably, the medical device 12 cannot access data relating to the usevalue(s) and/or usage limit(s) stored in the probe memory 26 until thevalidity of the medical device 12 is validated by the securityfunction(s) in the medical probe 14. Step 43 can be accomplisheddirectly, by processing in the probe memory 26, or indirectly, byemploying a security key found only inside a valid medical device 12when applying the encryption algorithms of the data encoding system tothe contents of the probe memory 26. If the security function fails tovalidate the medical probe 14, a message is preferably written to thedisplay 20 of the medical device 12 and/or an audible alarm is generatedby the audio output 17 (Step 41), and the controller 16 inhibitsfunctions related to the medical probe 14 until a new one is attached(Step 42).

Preferably, in Step 43 the security function also validates the memorycomponent 26 integrity by verifying that the contents of the memorycomponent 26 have not been tampered with before proceeding. Besidessuccessful decryption in Step 43, further steps at validation of memoryintegrity include examination of validity of date and time stamps, andpossibly lookup of the serial number of the medical probe 14 in adatabase stored inside of or in communications with the medical device12, as part of the probe auto-identification function.

In alternative embodiments, as part of probe evaluation, a functionaltest sequence is invoked in Step 44, wherein each of theeffector/sensor(s) 24 of the medical probe 14 is activated to verifyfunctionality. For example, in a pulse oximeter sensor the functionaltests may include correlation of a response of the detector 32 with adrive, or electrical current level, of the LED 30 for the plurality ofLED(s) illuminating the detector 32. In Step 44.1, the results of thesefunctional tests can be reported by storing the results in internalmemory 18 of the medical device 12, writing the results to the probememory 26 in the medical probe 14, writing the results to the display 20for immediate review by medical personnel, or a combination of theabove.

If the probe fails the functional tests, the method defaults to Step 41and a violation message, describing the functional test failure isdescribed, and a message indicating “Replace Probe” is written todisplay 20 and/or an audible alarm is generated by audio output 17.Functions of the medical device 12 related to this medical probe 14 areinhibited until another probe is connected to the medical device 12.

Upon completion of the security function of Step 43 and functional testsof Step 44, the identifying data of the medical probe 14 (e.g., theserial number) is preferably stored in Step 45 in the memory 18 of themedical device 12 for identification purposes. The identifying data ofthe medical device 12 is preferably stored in the probe memory 26 toprovide a cross check, as will be described more fully below.

This exchange of identifying data is the basis for the probeauto-identification function, considered to be part of the usagecriteria testing. In Step 45, the medical device 12 can use the probe'sidentifying data read from the medical probe 14 to determine the type ofprobe being used. For example, if the medical system 10 is used forfetal pulse oximetry, the medical device 12 can determine if theattached medical probe 14 is a fetal monitoring sensor, versus a sensordevice more commonly used with adults, such as a finger sensor. Usingthis information, the medical device 12 can adjust parameters andalgorithms to match the specific functional requirements of the medicalprobe 14. Such parameters for sensor devices 24 include dynamic range,signal processing characteristics, probe calibration, medical alarmlimit values, display content and format, trend data storage content andformat, and network communications content and format. In a pulseoximeter sensor, the parameters may include LED emission characteristics(e.g., center wavelength(s) and spectrum width(s)), calibration table(normalized ratio versus SPO₂ value), and detector characteristics.

Another feature of the auto identification function of Step 45 uses theidentifying data of the medical probe 14, in conjunction withinformation about the configuration of the medical device 12 and patientdata available in the medical system 10, 101 to validate the combinationof the medical probe 14, the medical device 12, a patient, and/or a modeof operation of the medical device 12, e.g., a procedure (therapy ormonitoring).

If an inappropriate combination of medical probe 14 and medical device12 is detected (e.g., a fetal sensor attached to an adult monitor(medical device), rather than a fetal sensor attached to a fetal monitor(medical device)), in Step 50 a message describing the violation ispreferably written to the display 20 and/or an audible alarm isgenerated by the audio output 17. Functions of the medical device 12related to this medical probe 14 are inhibited until another probe isconnected to the monitoring device 12 (Step 42). This is an automationof the safety features provided by the auto-identification function(s).

Once the identifying data and other contents of the probe memory 26 ofthe medical probe 14 are verified, in Step 46 the medical device 12reads the use value(s) from the probe memory 26 and preferably storesthe use value(s) in internal memory 18 of the medical device 12.Optionally, the usage limit(s) of the usage criteria can also be readfrom the probe memory 26.

A possibility exists that the connection of the medical probe 14 withthe medical device 12 may be interrupted during a single use, so in Step46 a probe re-identification feature may be invoked. This interrupteduse of the medical probe 14 can commonly occur for technical reasons,e.g., in order to move or assist the patient, or by accident. Ifincluded in the usage criteria for the probe 14 is a limitation on thenumber of uses, an interruption could pose a problem. To avoid theinconvenience of counting the resumption of use after such aninterruption as a “new” use, in a preferred embodiment of the invention,a re-identification method may be provided in Step 46, further detailedin FIG. 3C.

Probe re-identification corresponds to a medical probe 14 being used inconjunction with a particular medical device 12, disconnected for ashort time, and then reattached to either the same or another medicaldevice 12. Even if the number of uses is not among the limitations onusage, the re-identification of a medical probe 14 by a differentmedical device 12 is important to the proper maintenance of patient datain the memory 18 of the medical device 12, as will be revealed below.

In Step 46.1 the date and time of last use (PLU) are read from themedical probe 14 as part of the use value(s) retrieved in Step 46, andcompared to the current date and time (M_(CU)) in the medical device 12.Various methods of representing time over a sufficient range (days toyears) and with sufficient accuracy (seconds to minutes) and readilypermitting arithmetic operations, such as comparison, are well known inthe art. The interruption time, T, is computed in Step 46.1 as thedifference M_(CU)-P_(LU) with the assumption that the “clocks” of allmedical devices 12 in use are consistent.

The interruption time T is compared in Step 46.2 with an interruptiontime limit (ITL), stored in either the medical probe memory 26 or themedical device memory 18. In one embodiment, if the currently attachedprobe was not last used within the interruption time limit (T>ITL), thena new use of the probe 14 must be counted. The logic for a new use ofthe probe 14 proceeds with the initial test of use values andestablishment of “effective use” of the probe in Step 48, describedbelow. In the preferred embodiment of a fetal sensor for oxygensaturation measurement, one hour is a suitable interruption time limit.

A negative value of T (T<0) is indicative of a mismatch between clocksin different medical devices 12. A small negative T may be treated as azero result; a large negative magnitude would be interpreted as a usagecriteria violation in Step 50. However, if the currently attached probewas last used within the interruption time limit (0<T≦ITL), thenre-identification has been accomplished, and a new use is not counted.In a preferred embodiment, the medical device 12 may further compare theidentifying data for the medical probe 14 with the identifying data forrecently used medical probe(s) 14 stored in the medical device memory18, as shown in Step 46.3. If a match is found, and the identified probe14 is the last one used with this medical device 12, as determined inStep 46.4, then the same use of the probe immediately resumes at Step52.

If this probe 14 is not the last one used with this medical device 12,or if this probe was never previously used with the medical device, thenit is advisable to warn the operator that a probe and/or patient changehas taken place. Preferably, the newly-connected medical device 12warns, in Step 46.5, that the medical probe was previously connected toa different device by writing a message to the display 20 and/orgenerating an audible alarm by means of the audio output 17. Thissituation could occur if, for example, the medical device 12 is takenout of service and replaced with another unit (medical device) aftereffective use of the probe 14 has commenced. However, it could also takeplace if multiple probes attached to monitors (medical devices) ondifferent patients, e.g., in a ward or nursery setting, wereaccidentally interchanged, making re-identification important forpatient safety. In a preferred embodiment, in Step 46.5 an operator willindicate whether this is indeed a re-identified sensor, proceeding toStep 46.6, or a new use, proceeding with Step 48.

Prior to enabling functions of medical probe 14, the medical device 12will preferably update the clinical data in the device memory 18 in Step46.6. In a preferred embodiment, old clinical data in the memory 18 isarchived and/or purged, and patient data including identifying data andclinical data stored in the probe memory 26 is transferred from themedical probe 14 to the memory 18 of the medical device 12, as shown inStep 46.6. This transfer is preferably conditioned upon use of securitymeans to validate that the medical device's operator is authorized toobtain any confidential data from the probe 14, including, but notlimited to patient identification data and clinical data.

In another preferred embodiment, the medical device 12 may furthervalidate the re-identification of the probe 14 by comparison of patientidentifying information read from both the probe memory 26 and thedevice memory 18. This may detect an attempt to reuse the probe 14 on anew patient without sufficient time for cleaning and/or sterilization.

In yet another preferred embodiment, the medical device 12 may in Step46.6 read from the probe memory 26 the identifying data for a medicaldevice 12 to which the medical probe 14 was previously connected. Thisidentifying data can be used by the currently connected medical device12 to request the transfer of stored patient data from the previouslyused medical device. The request may take the form of a message tomedical personnel, or direct transfer via an electronic connection suchas a network (not shown).

If re-identification is accomplished, the logic then proceeds directlyto Step 52. Otherwise, if the auto-identification of probe and intendeduse is deemed acceptable, in Step 48 the use value(s) can then becompared to usage limit(s), in terms of either count, duration, shelflife, regulatory guidance limit (if any) or warranty period to verifythat the use value associated with the medical probe 14 has not reacheda usage limit value. If a use value is substantially equivalent to thecorresponding usage limit, in Step 50 a violation message, describingthe type of violation and indicating that a new probe is required, ispreferably written to the display 20 and/or an audible alarm isgenerated by the audio output 17. In Step 42 functions of the medicaldevice 12 related to this medical probe 14 are inhibited until anotherprobe is connected to the medical device 12.

Note that Step 42, inhibition of functions related to the medical probe14, may be implemented in a number of ways. Without affecting the probe,the firmware of the controller 16 can simply be programmed to notperform processing related to the probe's functions. Alternately, themedical device 12 can change the probe memory 26 of the medical probe 14in order to prevent any future reading and/or writing therein. Lastly,the medical device 12 can disable the functionality of thesensor/effector 24 by physically changing the device. For example, in apulse oximetry sensor, a fuse or fusible link may be placed in line withthe connections to one or both of the LEDs 30. By applying asufficiently high current, the controller 16 could thereby disable thepulse oximetry sensor.

If none of the “usage criteria” are violated, then in Step 52 the usevalue may be displayed on display 20. In some embodiments, regardless ofwhether any usage violation has occurred, the use value(s) are writtento the display 20 by the controller 16 to alert medical personnel to theremaining usefulness of the probe 14 (Step 52). If the remainingusefulness is limited, this information helps an operator to determinewhether to replace the medical probe 14 or proceed with the therapy ormonitoring.

In some applications, where the probe memory 26 is a microcontroller,microprocessor, or other device with more advanced mathematicalcapabilities, the use value(s) can be maintained in the probe memory 26and updated internally, without further interaction with the medicaldevice 12, as long as power is applied to the medical probe 14.

After the use value is displayed in Step 52, the probe functions areenabled. From time to time, the medical device 12 will test whether themedical probe is still in use, Step 54, and determine whether themedical probe has been in effective use for a length of time sufficientto count as a “use”.

The commencement of therapeutic or monitoring activity with the medicalprobe 14 is indicated by a start-of-usage event. Any signal normallyused by the medical device 12 to begin the therapeutic or monitoringsequence associated with medical probe 14 can be used as thestart-of-usage event, to commence updating the use value(s)in Step 56.Examples of suitable start-of-usage events are reading an activatedpushbutton or other switching device indicating commencement of therapyreading an input signal from an external device, or, in someapplications, connecting the medical probe 14 to the medical device 12.

The start-of-usage event will typically be conditioned upon completionof a minimal amount of effective use. For example, in an applicationwhere medical monitoring may be expected to go on for hours, it isreasonable to require a short period of effective monitoring (medicalprobe in place, signals received and interpretable, results displayed,etc.) prior to considering the monitoring “effective”. This prevents thesystem from deducting a “use” from the life of a medical probe becauseit was briefly tested, inadvertently turned on, connected in order tocause display of the useful life left, or was demonstrated withoutactual clinical benefit. These events would not be considered aneffective use, to update the use value(s) in Step 56. In a preferredembodiment in a pulse oximetry sensor, five minutes of successfulmonitoring of the oxygen saturation and pulse rate data is consideredeffective use to constitute a “use.”

When the therapy or monitoring is deemed to have started, a date andtime stamp, along with the identifying data of the medical probe 14, ispreferably stored in the memory 18 of the medical device 12 (Step 56). Ausage record consisting of the date and time stamp, along with theidentifying data of the medical device 12, is preferably stored in theprobe memory 26 of the medical probe 14. It will be obvious that theusage records can be stored either in the medical probe 14, the medicaldevice 12, or both.

In Step 56 the use value is updated, e.g., a usage time limit isdecremented, accordingly.

In Step 57, a comparison is made with the usage criteria and the updateduse value(s) to determine if any usage criteria are violated. If nousage criterion is violated, then the probe use logic returns to Step54, and the Steps 54-57 repeat until a usage criterion is violated orthe probe is no longer in use. When a usage criterion is violated, e.g.,the corresponding use value is equivalent to a predetermined value, inStep 58 a violation message is displayed and/or an audible alarm ismade.

In applications where the usage criterion is duration of use, a timingfunction must be activated when the start-of-usage event occurs.Preferably, the controller 16 of the medical device 12 performs thetiming function. Alternatively, in applications where the memory storagedevice 26 is a microcontroller or other device capable of providing atiming function, the timing function may be performed in the medicalprobe 14. When the duration of use of the medical probe 14 issubstantially equivalent to a predetermined value, the controller 16 inthe medical device 12 will preferably write a usage criterion violationmessage to the display 20 and/or generate an audible alarm by means ofthe audio output 17 (Step 58).

In applications where a usage criterion is a number of total uses, theuse value must be changed only once for each therapeutic or monitoringsequence. When the use value reaches a predetermined number of uses, amessage describing the usage criterion violation is preferably writtento the display 20 of the medical device 12, and an audible alarm isgenerated by the audio output 17. Preferably, a warning will be writtento the display 20 by the controller 16 prior to the last use, therebyallowing medical personnel to obtain a new probe for replacement. Insome applications, a continual count may be maintained on the display 20of the medical device 12. Once the use value has reached the usage limitvalue, the controller 16 in the medical device 12 will preferably writea usage criterion violation message to the display 20 and/or generate anaudible alarm by means of the audio output 17 (Step 58).

Depending upon the type of medical probe 14, its mode of use by themedical device 12, and the usage criteria that has been violated,different actions may be selected when a usage violation occurs. Afterthe violation message has been displayed and/or the audible alarm made,in Step 58, further function of the medical probe 14 may be immediatelyinhibited, or permitted to continue.

If the medical probe 14 is permitted to continue to be used, then theinvention repeats Steps 54-59, e.g., a determination is again made inStep 54 as to whether the medical probe 14 is in use, etc. If thefunction is not allowed to continue in Step 59, processing will proceedto step 62, wherein the invention will update the memory 18 of themedical device 12 and/or the probe memory 26 of the medical probe 14,storing the use value, date and time stamp the use and then proceedingto Step 42 to inhibit the medical probe to function. Specifically, insome embodiments of the invention, especially those in which a timeduration limit is employed (e.g., duration of delivery of a drug dose),the medical device 12 will immediately inhibit function Step 42 untilthe medical probe 14 is replaced (Step 38).

In other embodiments, especially those in which the usage limit is basedupon the number of uses of the medical probe 14, it is permissible tofinish the current treatment or monitoring operation. Prior to beginninganother use of the same medical probe 14, however, the medical device 12will, in Step 46, read the use value and will not allow anothertherapeutic or monitoring usage to begin until the medical probe 14 isreplaced. Again, the timing function can be operated to count either upto a known value, or down from an initial value to zero. Althoughchanging the use value from an initial use number has been described interms of decrementing, it will be apparent to one of ordinary skill inthe art that the medical system 10 could be easily modified toincrement, decrement, or use an apparent random sequence.

Periodically during use of the medical probe 14, a date and time stamp,along with the identifying data of the medical probe 14, is preferablyupdated in the memory 18 of the medical device. This data can be used inconjunction with clinical logs to track the identity of the equipmentand the personnel that were involved in a given monitoring procedure.Likewise, usage is preferably periodically updated in the probe memory26 of the medical probe 14. Although this storage of usage records couldbe done only when the therapy or monitoring ends (Step 62), it may bepossible to shut off the medical system 10, or disconnect the medicalprobe 14, preventing the usage data from being recorded. This is a formof tampering with usage data.

Therefore, in a preferred embodiment, a full usage record of date andtime stamp, along with the identifying data of the medical device 12, iswritten to the medical probe 14 when effective usage is confirmed.Thereafter, at periodic time intervals during continued use, a bit iswritten in the probe memory 26 to keep an approximate record of durationof use. Preferably the periodic time interval is an hour, however theperiodic time interval may be shorter, e.g., a second. Typically, themedical device 12 contains non-volatile RAM used to hold the currentusage data, and this may be updated much more frequently, e.g., everysecond.

In some applications, the medical device 12 may include input devicessuch as keyboards, bar code readers, biometric scanners, serial links,and other communication devices, for logging the identity of cliniciansand the patient involved in a procedure, thereby providing a completelog for later review.

In a preferred embodiment, radio frequency identification functions canbe incorporated in the medical device 12 to identify medical personnel,patients, and other data. Preferably, date and time stamps, identifyingdata of the medical device 12, and other identifying data is stored inboth the probe memory 26 of the medical probe 14 and the memory 18 ofthe medical device 12 as a cross check. Storing this data in bothlocations simplifies the process of later identifying the equipment usedin a given monitoring process in the event of a failure. In someapplications, detailed data regarding medical parameters encountered ina given procedure may be stored. Alternatively, the controller 16 maycheck for defined errors or conditions and store data when suchconditions occur.

Although storing usage, date and time stamp data at the beginning ofeffective use and periodically during the function of the medical system10 has been described, it will be apparent to one of ordinary skill inthe art that this step could also be taken at the beginning of effectiveuse, after the occurrence of predefined conditions, in the event of asystem failure, at the end of use, in combinations, or in a number ofother ways.

Although a distinct functional block diagram has been shown in FIGS. 3A,3B and 3C, it will be apparent to one of ordinary skill in the art thatchanges in the order of certain functions, modifications of functions,and additions could be made without departing from the invention.

As noted above, in one highly preferred embodiment of the invention, anadd-only memory (AOM) is used as the probe memory 26. One suitabledevice is the DS2502, manufactured by Dallas Semiconductor, Inc. Thedata sheet for this component, as published by Dallas Semiconductor, isincorporated herein by reference. This device contains a factory-writtenregistration number plus multiple pages of user-programmable memory. Theregistration number contains a unique code for the customer (in thiscase, the manufacturer of the medical probe); a serial number; plus aCRC for validating the integrity of the data. The user-programmablememory can be written once, one bit at a time, and pages can beindividually write-protected after programming to prevent modification.

Another advantage of the DS2502 is its incorporation of the 1-Wire™multi-drop communications scheme, serving as the probe communicationsport 27. This method requires only a ground connection and secondconnection to supply power to the DS2502 as well as performbi-directional communication. Since the ground connection may beconnected to a common ground with other electrical functions in themedical probe, only one additional connection to the medical probe 14 isrequired.

Referring to FIGS. 1 and 2, the medical device 12 includes a device(host) communications port 19 consisting of appropriate hardware andsoftware to interface to the probe memory 26. A suitable implementationof the 1-Wire™ interface is the DS2480 Serial 1-Wire™ Line Driver, alsomanufactured by Dallas Semiconductor, Inc. The data sheet for thiscomponent, as published by Dallas Semiconductor, is incorporated hereinby reference. This device interfaces to the controller 16 via a standardUART, or serial interface. Generally, the firmware of the controller 16must include the ability to operate the device (host) communication port19, send commands to the probe communication port 27 to read and writethe probe memory 26; interpret status information from the hostcommunication port 19, the probe communication port 27, and the probememory 26; and complete the security function including the keysrequired by the encryption system used to secure communications and theability to update the use values.

The problems associated with prior art medical devices are particularlyacute in fetal monitoring devices, due to the internal placement ofsensors and conditions surrounding perinatal monitoring. Consequently,in a highly preferred embodiment of the present invention, the medicalprobe 14 comprises a fetal sensor 80 for monitoring the oxygensaturation and/or other medical parameters in utero, as can be seen inFIG. 4. An example of a fetal oxygen sensor is more fully described inU.S. Pat. No. 5,425,362, which is incorporated herein by reference. Thefetal sensor 80 includes a flexible housing 82 and a soft molded tip 86.Preferably the soft molded tip 86 is integrally coupled to the remainderof the fetal sensor 80. The flexible housing 82 and the soft molded tip86 help minimize the possibility of membrane rupture or tissue damage.The fetal sensor 80 includes a flexible strip, such as spring steel (notshown) coated with a smooth surfaced covering (such as a siliconerubber, thermoplastic elastomer (TPE), or Teflon).

The fetal sensor 80 can include preferably one or more of a variety ofsensors, such as a pressure sensor, an ECG sensor, an EEG sensor, atemperature sensor, an oxygen sensor, an ultrasound transducer/sensor, alaser diode emitting IR signals with an associated detector, and/or achemical sensor. In some applications, the fetal sensor 80 can include aballoon type device that can be inflated to variable pressures and usedwith conventional feed back electronics to maintain a substantiallyconstant pressure of engagement of the device with at least one of thefetus and the uterus of the mother.

In a preferred embodiment, shown in FIGS. 2 and 4, sensor 24 ispreferably the fetal sensor 80. Fetal sensor 80 includes a pulseoximetry sensor 108, which generally comprises two or more lightemitting devices 30 (e.g., LEDs) of varying wavelengths, and one or morephotodetector(s) 32. A light blocker 106 ensures that light passesthrough the fetal tissue rather than directly from the emitters to thedetectors. Relative intensity of the light backscattered from the fetaltissue at different wavelengths is used to calculate oxygenation levelsin ways known in the art.

Also, in the preferred embodiment, shown in FIG. 2, the medical device12 comprises an oximeter for calculating the oxygenation (SpO₂) level.One particular example of a pulse oximeter is described in U.S. Pat. No.6,163,715 B1, issued to Larsen et al., which disclosure is incorporatedby reference herein. The fetal pulse rate may also be derived from thedetected signals of the fetal sensor 80, as revealed in U.S. Pat. No.6,339,715.

Referring again to FIGS. 2 and 4, all of the connections of the fetalsensor 80 are routed via a cable 110 to a single connection point withthe medical device 12. In a preferred embodiment, the connection pointcomprises a connector 122 that couples to a mating connector of themedical device 12. The probe memory 26 is preferably embedded in theconnector 122 to limit the overall size of the medical probe 14 andreduce the risk of tampering. The medical device 12 preferably providespower for the medical probe 14.

The medical device 12 is in this preferred embodiment a fetal pulseoximeter. The start-of-usage event is conditioned upon the fetal sensor80 being connected and in place, yielding signals that result insuccessful monitoring of oxygen saturation and pulse rate for at leastfive minutes. At that time and every hour thereafter, a usage record iswritten to the probe memory 26 as long as the fetal sensor 80 remainsattached the medical device 12 and the pair remain in use.

Although in the preferred embodiment the connector 122 has been shownfor handling electrical signals, it will be apparent to one of ordinaryskill in the art that infrared, radio frequency or fiber opticconnections, or some combination of means, could be utilized withappropriate rearrangement of illustrated components without departingfrom the invention.

In FIG. 5, another embodiment of the present invention, a medicalreprocessing system 410 is shown. The medical reprocessing system 410includes a medical probe 14 attached to a medical reprocessor 412 via anexternal connection 120. The medical probe 14 that has been disabled asa result of usage criteria violation(s) is shown attached to the medicalreprocessor 412. In FIG. 6, a preferred medical reprocessing system 411,is shown having a medical probe 14, where the medical probe 14 ispreferably a pulse okimetry sensor. The medical probe 14 of FIG. 5 maybe any of the previously discussed herein medical probes, having aneffector/sensor 24, a probe memory 26, and an external connectionconfigured for transferring data between the medical reprocessor 412 andthe probe 14. The external connection may be connection 120 previouslydescribed herein, or a unique connection may be employed forreprocessing, without loss of generality. The medical reprocessor 412,shown in FIGS. 5 and 6, consists of a controller 416, a memory 418, areprocessor communication port 419, a function tester 420, and anexternal connection means 430. A function tester establishes whether thesensor(s) and effector(s) 24 of the medical probe 14 are functioningwithin normal operating limits, verifying, e.g., signal strength andsignal to noise ratio of sensor(s) and current draw of effector(s).

FIG. 7 is an operational block diagram of the medical reprocessingsystem 410, 411 as shown in FIGS. 5 and 6. The medical reprocessingsystem 410 or 411, performs security function(s) and functional testingto determine whether reuse of the medical probe is authorized. In Step538, a medical probe 14 is detected to be attached to the reprocessor412.

In Step 540, the reprocessor 412 attempts to read the contents of theprobe memory 26 through the reprocessor communication port 419 inconnection with the probe communication port 27 via a “Read Request” anddetects an “acknowledge” from the probe memory 26. If the medical probe14 is damaged or the probe memory 26 is incorrectly programmed, themedical probe 14 will not acknowledge the read request and in Step 543the display 420 will display a message “Probe Memory Error”. Thus, inStep 540 and 543, a medical probe with a damaged probe memory or withincorrectly programmed probe memory is rejected as unusable. In Step542, a security function is run on the probe 14 as described previouslyherein. If the medical probe 14 fails the security function, then thedisplay message is “Probe Memory Error.”

In Step 544, the controller 416 directs functional tests of the medicalprobe 14. The functional testing of Step 544 may include verifying that:the sensor(s) and/or effector(s) in the medical probe 14 are operatingwithin design parameters; the physical integrity of the medical probe 14is adequate (e.g., surface testing for cracks); and/or determining theefficacy of cleaning and sterilization (e.g., evaluation of biologicalindicators, surface examination for contaminants, etc.). If the medicalprobe 14 fails functional tests, in Step 545 the display 420 displays amessage “Probe Function Error”.

In Step 546 the controller 416 seeks reuse authorization forreprocessing of the medical probe 14. The reuse authorization of Step546 may be a local function in the form of an algorithm run by thecontroller 416, evaluating usage history, functional testing, and otherdata. Alternately, the reuse authorization step may depend upon asecurity code, manually entered by an operator, or obtained in atransaction with a remote party via the external connection means 430.In yet another alternate embodiment, the entire reuse authorization stepmay be performed by a remote party supplied the usage history andfunctional testing data via the external connection 430, and returning areuse authorization decision. The external connection 430 may betelephonic, cable, radio frequency, or other technology. In a preferredembodiment, the controller 416 utilizes standard Internet technology topass transactions reliably and securely to a remote reuse authorizationparty over the external connection 430. Reuse authorization may includeassessment of licensing fees related to reprocessing of the medicalprobe 14.

If reuse authorization in Step 546 is refused, then in Step 550, thedisplay 420 displays a message that the “Probe Expired.” The probefunction is disabled in Step 551 and the medical probe 14 cannot bereused.

If the authorization for reuse is granted in Step 546, then in Step 548,the probe memory 26 is modified to permit further use of the medicalprobe 14. The modification of the probe memory 26 may include datachanges, such as resetting the date of manufacture to represent the dateof reprocessing (extending shelf and warranty life); clearing theduration of use value; zeroing the count of uses; and so forth.Additionally, usage criteria data stored in the probe memory 26 may bemodified to reflect a change in condition of the medical probe 14. Toprotect the privacy of patient data, in a preferred embodiment allpatient-specific data, including patient and caregiver identification,clinical data, procedures, physiological data, and timestamps thereof,are deleted from the probe memory 26.

If in Steps 543, 545, or 550 a medical probe 14 fails reprocessing forany reason, in Step 551, the medical probe 14 may be disabled to preventfurther attempts at use. Disabling the probe functions consist of atleast removal of any patient-specific data from the probe memory 26. Ina preferred embodiment, the probe memory 26 may be locked to prevent anyfurther write operations to it. Preferably, the functions of thesensor/effector(s) 24 are directly disabled, as suggested above for thecase of a pulse oximetry sensor, for example by opening a fuse orfusible link with a sufficiently high electrical current.

In a preferred embodiment shown in FIG. 6, the medical reprocessingsystem 411 is designed for use with a medical probe 14 that is a pulseoximetry sensor, such as fetal sensor 80 of FIG. 4 for performing fetalpulse oximetry. The function tester 413 provides means to sense open andshort circuits in the medical probe 14, evaluate current draw and lightoutput of the light emitting device(s) 30, sensitivity and noise of thephotodetector(s) 32, and perform other tests.

While preferred embodiments have been illustrated and described, itshould be understood that changes and modifications can be made theretowithout departing from the invention in its broadest aspects. Variousfeatures of the invention are defined in the following claims.

1. A medical probe for use with a medical device, the medical probecomprising: a sensor or an effector; a probe communications port forcommunicating and transferring data between the medical probe and themedical device; a probe memory having data stored therein forfacilitating a security function and one or more other functions,including a probe auto-identification function, a probere-identification function, or a probe functional test sequence, whenthe medical probe is used in conjunction with the medical device; andwherein the probe memory further includes a reuse authorization functionfor reprocessing the medical probe.
 2. The medical probe as defined inclaim 1, wherein the probe re-identification function utilizes anidentifying data about the medical probe, and a time and date stamp of alast use of the medical probe, a current date and time, and both anidentifying data and a time and date stamp of use corresponding to thepreviously used medical probe stored in the medical device.
 3. Themedical probe as defined in claim 1, wherein the probe memory includes aset of probe identifying data and the medical device includes a probeauto-identification function utilizing the probe identifying data. 4.The medical probe as defined in claim 1, wherein the probe functionaltest sequence of the medical device activates the medical probe toverify functionality of the sensor or the effector of the medical probe.5. The medical probe as defined in claim 1, wherein the securityfunction is in the medical probe or in the medical device or in both. 6.The medical probe as defined in claim 1, wherein the security functionincludes a physical security method, or an algorithmic security method,or both.
 7. The medical probe as defined in claim 6, wherein thephysical security method includes a portion of the probe memory having awrite-once memory.
 8. The medical probe as defined in claim 6, whereinthe algorithmic security method includes a data encoding system withencryption in the medical device for encrypting data before it is storedin the probe memory and for decrypting data read from the probe memoryin the medical device; or wherein the algorithmic security methodincludes a data encoding system with encryption in the medical probe forencrypting data from the medical device in the probe memory when it isstored therein, and for decrypting data stored in the probe memory whenit is read by the medical device.
 9. The medical probe as defined inclaim 8, wherein the data encoding system incorporates symmetricalencryption or wherein the data encoding system incorporates asymmetricalencryption.
 10. The medical probe as defined in claim 8, wherein thedata encoding system incorporates public key encryption.
 11. The medicalprobe as defined in claim 1, wherein the medical probe is a pulseoximetry sensor.
 12. The medical probe as defined in claim 1, whereinthe medical probe is a fetal sensor probe.
 13. The medical probe asdefined in claim 12, wherein the fetal sensor probe is a limited usefetal sensor probe including a housing and at least one sensor deviceand wherein the probe memory includes the probe communications port, theprobe memory storing a set of use values for limiting use of the probeaccording to a set of usage criteria.
 14. The medical probe as definedin claim 13, wherein the sensor device is a pulse oximetry sensor usedfor measuring oxygen saturation in fetal tissue.
 15. The medical probeas defined in claim 13, wherein the probe memory comprises an add-onlymemory device.
 16. A medical reprocessing system comprising: a medicalreprocessor; and a medical probe having a sensor or an effector, a probecommunications port and a probe memory having a security function and areuse authorization function for reprocessing the medical probe.
 17. Themedical reprocessing system as defined in claim 16, wherein the medicalreprocessor includes a controller, a medical processor memory, areprocessor communications port, a functional tester and an externalconnection configured to communicate with the medical probe and toreceive from the medical probe a set of use values for determiningwhether the medical probe should be disabled or reprocessed for re-useusing the reuse authorization function.
 18. A method for reprocessing amedical probe in a medical reprocessing system having a medicalreprocessor, the medical probe having a probe memory with a reuseauthorization function therein for reprocessing the medical probe, themethod comprising the steps of: (a) coupling the medical probe to themedical reprocessor in the medical reprocessing system; (b) using thereuse authorization function for seeking authorization to reprocess themedical probe; and (c) disabling the medical probe, if the reuseauthorization fails; or clearing the probe memory and storing newcontents therein to permit further use of the medical probe, if thereuse authorization is successful.
 19. The method for reprocessing amedical probe as defined in claim 18, wherein the medical reprocessingsystem includes an external connection, the method including the step ofremotely performing Steps (b) through (c) via the external connection.20. The method for reprocessing the medical probe in the medicalprocessing system as defined in claim 18, wherein the medicalreprocessor includes a controller, a medical processor memory, areprocessor communications port, and a function tester; and wherein themedical probe includes a sensor or an effector and a probecommunications port, and wherein the probe memory includes a securityfunction and the reuse authorization function therein, the methodfurther comprising the steps of: (d) retrieving a set of use valuesassociated with use of the medical probe from the probe memory throughthe reprocessor communications port in communications with the probecommunications port after Step (a); (e) using the security function fordecrypting data stored in the probe memory to verify that a contents ofthe probe memory have not been corrupted or tampered with; (f) using thecontroller to perform a set of function tests on the medical probe usingthe function tester; and wherein Step (c) further includes disabling themedical probe, if any of the function tests fail; or wherein Step (c)further includes clearing the probe memory and storing new contentstherein to permit further use of the medical probe if the function testsand the reuse authorization are successful.